Merge pull request #211 from WillAbides/commandcontext

Make G204 look for CommandContext calls

Author: Cosmin Cojocar

rules/subproc.go

@@ -58,6 +58,7 @@ func (r *subprocess) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) {
 func NewSubproc(id string, conf gosec.Config) (gosec.Rule, []ast.Node) {
 	rule := &subprocess{gosec.MetaData{ID: id}, gosec.NewCallList()}
 	rule.Add("os/exec", "Command")
+	rule.Add("os/exec", "CommandContext")
 	rule.Add("syscall", "Exec")
 	return rule, []ast.Node{(*ast.CallExpr)(nil)}
 }

testutils/source.go

@@ -408,6 +408,19 @@ func main() {
   	log.Printf("Command finished with error: %v", err)
 }`, 1}, {`
 package main
+import (
+	"log"
+	"os/exec"
+	"context"
+)
+func main() {
+	err := exec.CommandContext(context.Background(), "sleep", "5").Run()
+ 	if err != nil {
+		log.Fatal(err)
+	}
+  	log.Printf("Command finished with error: %v", err)
+}`, 1}, {`
+package main
 import (
 	"log"
 	"os"